npm - @dotdrelle/wiki-manager - Versions diffs - 0.15.93 → 0.15.94 - Mend

@dotdrelle/wiki-manager 0.15.93 → 0.15.94

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/docker-compose.yml +1 -1
package/package.json +2 -2
package/src/agent/graph.js +42 -8
package/src/agent/graph.test.js +24 -1
package/src/cli/wiki-manager.js +103 -1
package/src/commands/slash.js +38 -4
package/src/commands/slash.test.js +11 -1
package/src/core/agentEvents.js +23 -0
package/src/core/agentEvents.test.js +37 -0
package/src/core/buildInfo.json +2 -2
package/src/core/dockerCompose.test.js +14 -0
package/src/core/mcp.js +1 -1
package/src/core/skillCompiler.test.js +21 -1
package/src/orchestrator/objectiveResolver.test.js +27 -0
package/src/runtime/loginPage.js +132 -0
package/src/runtime/loginRoutes.test.js +131 -0
package/src/runtime/loginSession.js +226 -0
package/src/runtime/loginSession.test.js +143 -0
package/src/runtime/qrCode.js +15 -0
package/src/runtime/runner.js +12 -0
package/src/runtime/runner.test.js +58 -0
package/src/runtime/server.js +206 -1
package/src/runtime/totp.js +87 -0
package/src/runtime/totp.test.js +80 -0
package/src/runtime/totpLogin.js +123 -0
package/src/runtime/vendor/qrcode.cjs +2297 -0

package/src/runtime/loginPage.js ADDED Viewed

@@ -0,0 +1,132 @@
+import { qrSvg } from './qrCode.js';
+function escapeHtml(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+/*
+ The single TOTP login page, served by the runtime. Enrollment shows the QR
+ code, the base32 secret and the otpauth:// URI; afterwards the same page is
+ a plain 6-digit code form. English UI chrome, like every other manager
+ surface. Verifying here also sets the shared `wiki_session` cookie on the
+ runtime's origin (server.js), so the same browser reuses the session on
+ serve when it runs on this host; serve sets its own cookie when a browser
+ reaches it first.
+ */
+export function loginPageHtml({ enrolled = false, secret = null, uri = null, error = null, sessionExpiresAt = null } = {}) {
+  const enrollBlock = !enrolled && secret
+    ? `
+      <section class="card">
+        <h2>Enroll your authenticator</h2>
+        <p>Scan the QR code with your authenticator app, or enter the secret manually:</p>
+        <div class="qr">${qrSvg(uri)}</div>
+        <code class="secret">${escapeHtml(secret)}</code>
+        <p class="hint">Manual entry: add an account, choose <strong>TOTP</strong> / time-based code, and paste the secret above.</p>
+      </section>`
+    : '';
+  const successBlock = sessionExpiresAt
+    ? `
+      <section class="card success">
+        <h2>Session active</h2>
+        <p>You are signed in until <strong>${escapeHtml(new Date(sessionExpiresAt).toLocaleString())}</strong>.</p>
+        <p class="hint">You can close this page.</p>
+      </section>`
+    : '';
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>wikiLLM — login</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin: 0; font-family: ui-sans-serif, system-ui, sans-serif; background: #f4f5f7; color: #1c1f26; display: flex; min-height: 100vh; align-items: center; justify-content: center; }
+  @media (prefers-color-scheme: dark) { body { background: #12141a; color: #e7e9ee; } }
+  .box { width: 100%; max-width: 380px; padding: 1.2rem; }
+  .brand { display: flex; align-items: center; gap: .5rem; margin-bottom: 1rem; }
+  .brand-mark { width: 2rem; height: 2rem; border-radius: 8px; background: #2563eb; color: #fff; display: inline-flex; align-items: center; justify-content: center; font-weight: 800; }
+  .brand-name { font-weight: 700; font-size: 1.05rem; }
+  .card { background: #fff; border: 1px solid #d9dce3; border-radius: 12px; padding: 1.1rem 1.2rem; margin-bottom: .9rem; box-shadow: 0 1px 3px rgba(0,0,0,.05); }
+  @media (prefers-color-scheme: dark) { .card { background: #1b1e26; border-color: #333843; } }
+  .card.success { border-color: #22c55e; }
+  h2 { margin: 0 0 .5rem; font-size: 1rem; }
+  p { margin: 0 0 .8rem; font-size: .85rem; line-height: 1.45; }
+  p:last-child { margin-bottom: 0; }
+  .hint { color: #6b7280; font-size: .78rem; }
+  .qr { display: flex; justify-content: center; padding: .5rem 0; }
+  .qr svg { width: 180px; height: 180px; }
+  .secret { display: block; text-align: center; font-family: ui-monospace, monospace; font-size: .82rem; letter-spacing: .08em; background: #f1f2f5; border-radius: 8px; padding: .5rem; margin: .4rem 0 .7rem; user-select: all; }
+  @media (prefers-color-scheme: dark) { .secret { background: #111319; } }
+  form { display: flex; gap: .5rem; }
+  input[type="text"] { flex: 1; min-width: 0; font: inherit; font-size: 1.15rem; letter-spacing: .35em; text-align: center; padding: .55rem .4rem; border: 1px solid #c9cdd6; border-radius: 8px; background: #fff; color: inherit; }
+  @media (prefers-color-scheme: dark) { input[type="text"] { background: #12141a; border-color: #3a3f4b; } }
+  input[type="text"]:focus { outline: 2px solid #2563eb; outline-offset: 1px; border-color: #2563eb; }
+  button { font: inherit; font-weight: 700; padding: .55rem 1rem; border: 0; border-radius: 8px; background: #2563eb; color: #fff; cursor: pointer; }
+  button:hover { background: #1d4fd7; }
+  button:disabled { opacity: .55; cursor: default; }
+  .error { color: #dc2626; font-size: .8rem; margin-top: .6rem; }
+</style>
+</head>
+<body>
+<div class="box">
+  <div class="brand"><span class="brand-mark">W</span><span class="brand-name">wikiLLM</span></div>
+  ${enrollBlock}
+  ${successBlock}
+  ${sessionExpiresAt ? '' : `
+  <form id="login-form" autocomplete="off">
+    <input id="code" name="code" type="text" inputmode="numeric" pattern="[0-9]*" maxlength="6" placeholder="000000" aria-label="Verification code" autofocus required>
+    <button type="submit" id="submit">Verify</button>
+  </form>
+  <p class="error" id="error" hidden></p>`}
+</div>
+<script>
+(function () {
+  var form = document.getElementById('login-form');
+  if (!form) return;
+  var input = document.getElementById('code');
+  var submit = document.getElementById('submit');
+  var error = document.getElementById('error');
+  input.addEventListener('input', function () {
+    input.value = input.value.replace(/\\D/g, '').slice(0, 6);
+  });
+  form.addEventListener('submit', async function (event) {
+    event.preventDefault();
+    var code = input.value.replace(/\\D/g, '');
+    if (code.length !== 6) return;
+    submit.disabled = true;
+    error.hidden = true;
+    try {
+      var response = await fetch('/login/verify', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ code: code })
+      });
+      var payload = await response.json().catch(function () { return {}; });
+      if (response.ok && payload.ok) {
+        document.querySelector('.box').innerHTML = payload.page;
+      } else {
+        error.textContent = payload.error || 'Verification failed.';
+        error.hidden = false;
+        input.value = '';
+        input.focus();
+      }
+    } catch (err) {
+      error.textContent = 'The login service is not answering.';
+      error.hidden = false;
+    } finally {
+      submit.disabled = false;
+    }
+  });
+})();
+</script>
+</body>
+</html>`;
+}
+export function loginSuccessHtml(sessionExpiresAt) {
+  return loginPageHtml({ enrolled: true, sessionExpiresAt });
+}

package/src/runtime/loginRoutes.test.js ADDED Viewed

@@ -0,0 +1,131 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { startRuntimeServer } from './server.js';
+import { enrollment, issueSessionWithTotp } from './loginSession.js';
+import { totpCode } from './totp.js';
+/*
+ HTTP-level contract of the TOTP login surface: public before the bearer
+ gate, enrollment on the first code, session verification behind the bearer,
+ revocation. The store is stubbed — none of these routes touch it.
+ */
+let stateDir;
+let server;
+test.before(async () => {
+  stateDir = mkdtempSync(join(tmpdir(), 'login-routes-'));
+  process.env.WIKI_MANAGER_STATE_DIR = stateDir;
+  server = await startRuntimeServer({ host: '127.0.0.1', port: 0, store: { dbPath: null } });
+});
+test.after(async () => {
+  await server.close();
+  delete process.env.WIKI_MANAGER_STATE_DIR;
+  rmSync(stateDir, { recursive: true, force: true });
+});
+function baseUrl() {
+  return `http://127.0.0.1:${server.port}`;
+}
+test('GET /login shows the enrollment QR before any code was verified', async () => {
+  const response = await fetch(`${baseUrl()}/login`);
+  assert.equal(response.status, 200);
+  const html = await response.text();
+  assert.match(html, /Enroll your authenticator/);
+  assert.match(html, /<svg/); // the QR code
+  assert.match(html, /GE|base32/i);
+  const status = await (await fetch(`${baseUrl()}/login/status`)).json();
+  assert.deepEqual({ enabled: status.enabled, enrolled: status.enrolled }, { enabled: true, enrolled: false });
+});
+test('the first verified code enrolls and issues a session', async () => {
+  const pending = enrollment();
+  const code = totpCode(pending.secret);
+  const response = await fetch(`${baseUrl()}/login/verify`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ code }),
+  });
+  assert.equal(response.status, 200);
+  const payload = await response.json();
+  assert.equal(payload.ok, true);
+  assert.ok(payload.token.length >= 32);
+  assert.ok(payload.expiresAt > Date.now());
+  assert.match(payload.page, /Session active/);
+  // The session must reach the browser as a cookie, on the runtime's origin:
+  // that is what lets serve on the same host reuse the ShellUI login instead
+  // of asking for a second TOTP code.
+  const setCookie = response.headers.get('set-cookie') ?? '';
+  assert.match(setCookie, /wiki_session=/);
+  assert.match(setCookie, /HttpOnly/);
+  assert.match(setCookie, /SameSite=Lax/);
+  assert.ok(setCookie.includes(payload.token));
+  const status = await (await fetch(`${baseUrl()}/login/status`)).json();
+  assert.equal(status.enrolled, true);
+  assert.equal(status.sessionActive, true);
+});
+test('a wrong code is refused and repeated tries are rate-limited', async () => {
+  for (let attempt = 0; attempt < 10; attempt++) {
+    const response = await fetch(`${baseUrl()}/login/verify`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ code: '000000' }),
+    });
+    assert.equal(response.status, 401, `attempt ${attempt}`);
+    assert.equal((await response.json()).error, 'Invalid verification code.');
+  }
+  const refused = await fetch(`${baseUrl()}/login/verify`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ code: '000000' }),
+  });
+  assert.equal(refused.status, 429);
+});
+test('GET /session/verify checks the issued token and slides it', async () => {
+  const enrolledSecret = JSON.parse(readFileSync(join(stateDir, 'totp.json'), 'utf8')).secret;
+  const issued = issueSessionWithTotp(totpCode(enrolledSecret));
+  assert.equal(issued.ok, true);
+  const response = await fetch(`${baseUrl()}/session/verify?token=${encodeURIComponent(issued.token)}`);
+  assert.equal(response.status, 200);
+  const payload = await response.json();
+  assert.equal(payload.ok, true);
+  assert.equal(payload.ident, 'human');
+  assert.ok(payload.expiresAt > Date.now());
+  const unknown = await fetch(`${baseUrl()}/session/verify?token=nope`);
+  assert.equal((await unknown.json()).ok, false);
+});
+test('POST /logout without the session token does not revoke it', async () => {
+  const enrolledSecret = JSON.parse(readFileSync(join(stateDir, 'totp.json'), 'utf8')).secret;
+  const issued = issueSessionWithTotp(totpCode(enrolledSecret));
+  assert.equal(issued.ok, true);
+  const response = await fetch(`${baseUrl()}/logout`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+  assert.equal(response.status, 200);
+  assert.equal((await response.json()).revoked, false);
+  const after = await (await fetch(`${baseUrl()}/login/status`)).json();
+  assert.equal(after.sessionActive, true, 'this route sits before the bearer gate — a caller with no proof of the token must not be able to force the session out');
+});
+test('POST /logout with the session token revokes it', async () => {
+  const enrolledSecret = JSON.parse(readFileSync(join(stateDir, 'totp.json'), 'utf8')).secret;
+  const issued = issueSessionWithTotp(totpCode(enrolledSecret));
+  assert.equal(issued.ok, true);
+  const response = await fetch(`${baseUrl()}/logout`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ token: issued.token }),
+  });
+  assert.equal(response.status, 200);
+  assert.equal((await response.json()).revoked, true);
+  const after = await (await fetch(`${baseUrl()}/login/status`)).json();
+  assert.equal(after.sessionActive, false);
+});

package/src/runtime/loginSession.js ADDED Viewed

@@ -0,0 +1,226 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { defaultRuntimeStateDir } from '../core/env.js';
+import { digestEqual, generateTotpSecret, otpauthUri, verifyTotp } from './totp.js';
+/*
+ The TOTP login authority: one secret, one active session, stored in the
+ manager runtime state directory (0600). The session slides — every verified
+ check pushes the expiry forward — so "valid for the session" means 12 hours
+ of inactivity at most. Nothing here logs secrets or tokens.
+ */
+const SESSION_TTL_HOURS = Number(process.env.WIKI_MANAGER_SESSION_TTL_HOURS ?? 12);
+export const SESSION_TTL_MS = (Number.isFinite(SESSION_TTL_HOURS) && SESSION_TTL_HOURS > 0 ? SESSION_TTL_HOURS : 12) * 60 * 60 * 1000;
+// A pending enrollment lives only in memory: the secret is shown on the login
+// page BEFORE its first successful code, and only that code persists it.
+let pendingEnrollment = null;
+let pendingEnrollmentSince = 0;
+const PENDING_ENROLLMENT_TTL_MS = 30 * 60 * 1000;
+export function isTotpEnabled() {
+  const value = String(process.env.WIKI_MANAGER_TOTP ?? '').trim().toLowerCase();
+  return !['0', 'false', 'no', 'off'].includes(value);
+}
+function stateDir() {
+  return resolve(process.env.WIKI_MANAGER_STATE_DIR ?? defaultRuntimeStateDir());
+}
+function totpPath() {
+  return join(stateDir(), 'totp.json');
+}
+function sessionPath() {
+  return join(stateDir(), 'session.json');
+}
+function writePrivate(path, value) {
+  mkdirSync(resolve(path, '..'), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  try { chmodSync(path, 0o600); } catch { /* best-effort on platforms without chmod semantics */ }
+}
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+function currentTotpSecret() {
+  const record = readJsonFile(totpPath());
+  return record && typeof record.secret === 'string' && record.secret ? record : null;
+}
+export function loginStatus() {
+  const session = readJsonFile(sessionPath());
+  const sessionActive = Boolean(session && Date.now() < session.expiresAt);
+  return {
+    enabled: isTotpEnabled(),
+    enrolled: currentTotpSecret() !== null,
+    sessionActive,
+    sessionExpiresAt: sessionActive ? session.expiresAt : null,
+  };
+}
+export function enrollment() {
+  if (!isTotpEnabled()) return null;
+  if (currentTotpSecret()) return null;
+  const now = Date.now();
+  if (!pendingEnrollment || now - pendingEnrollmentSince > PENDING_ENROLLMENT_TTL_MS) {
+    const secret = generateTotpSecret();
+    pendingEnrollment = { secret, label: 'wiki', issuer: 'wikiLLM', createdAt: now };
+    pendingEnrollmentSince = now;
+  }
+  return {
+    secret: pendingEnrollment.secret,
+    uri: otpauthUri(pendingEnrollment.secret, { label: pendingEnrollment.label, issuer: pendingEnrollment.issuer }),
+  };
+}
+export function isLoopbackAddress(address) {
+  // "::" is the unspecified/any address (a bind address, never a real peer's
+  // remote address) — only "::1" is actually loopback. Treating it as
+  // loopback would trust a connection whose address we failed to read as if
+  // it proved local origin.
+  const value = String(address ?? '').replace(/^::ffff:/, '').trim();
+  if (value === '::1') return true;
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(value)) return false;
+  return value.startsWith('127.');
+}
+/*
+ Verifies a 6-digit code and issues the session. The FIRST successful code
+ while nothing is enrolled ENROLLS: it persists the pending secret — never a
+ code that failed verification. Returns { ok, enrolled, token, expiresAt } or
+ { ok: false, error }.
+ */
+// remoteAddress defaults to loopback, not "unknown": the only production
+// caller (server.js's /login/verify) always resolves and passes an explicit
+// value (including an explicit null when the socket itself reports none),
+// so this default is only ever exercised by a direct/programmatic call with
+// no HTTP request behind it at all (tests, internal callers) — which really
+// is local, unlike an HTTP request whose remote address could not be read.
+export function issueSessionWithTotp(code, { timestamp = Date.now(), remoteAddress = '127.0.0.1' } = {}) {
+  if (!isTotpEnabled()) return { ok: false, error: 'totp_disabled' };
+  const existing = currentTotpSecret();
+  const enrolled = Boolean(existing);
+  const secret = existing ? existing.secret : pendingEnrollment?.secret;
+  if (!secret) return { ok: false, error: 'no_enrollment' };
+  // Enrollment shows the secret in the page: only the host itself may claim
+  // it. An address we could not determine is not proof of loopback origin —
+  // refuse it, the same as any other non-loopback address.
+  if (!enrolled && !isLoopbackAddress(remoteAddress)) {
+    return { ok: false, error: 'enrollment_requires_loopback' };
+  }
+  if (!verifyTotp(secret, code, { timestamp })) return { ok: false, error: 'invalid_code' };
+  if (!enrolled) {
+    writePrivate(totpPath(), {
+      secret,
+      issuer: pendingEnrollment?.issuer ?? 'wikiLLM',
+      label: pendingEnrollment?.label ?? 'wiki',
+      enrolledAt: new Date(timestamp).toISOString(),
+    });
+    pendingEnrollment = null;
+  }
+  const token = randomBytes(32).toString('hex');
+  const issuedAt = timestamp;
+  const session = { token, ident: 'human', issuedAt, lastSeen: issuedAt, expiresAt: issuedAt + SESSION_TTL_MS };
+  writePrivate(sessionPath(), session);
+  return { ok: true, enrolled: true, token, expiresAt: session.expiresAt };
+}
+let lastSessionWriteMs = 0;
+export function verifySessionToken(token, { timestamp = Date.now(), renew = true } = {}) {
+  if (!token) return { ok: false, reason: 'missing_token' };
+  const session = readJsonFile(sessionPath());
+  if (!session || !digestEqual(session.token, token)) return { ok: false, reason: 'invalid_token' };
+  if (!(timestamp < session.expiresAt)) return { ok: false, reason: 'expired' };
+  if (renew && timestamp - session.lastSeen > 60_000) {
+    session.lastSeen = timestamp;
+    session.expiresAt = timestamp + SESSION_TTL_MS;
+    // Persist at most once a minute; the slide is generous on purpose.
+    if (timestamp - lastSessionWriteMs > 60_000) {
+      lastSessionWriteMs = timestamp;
+      writePrivate(sessionPath(), session);
+    }
+  }
+  return { ok: true, ident: session.ident, issuedAt: session.issuedAt, lastSeen: session.lastSeen, expiresAt: session.expiresAt };
+}
+// Requires the session's own token as proof of possession. POST /logout sits
+// before the bearer gate by design (the door, not a room) — an unauthenticated
+// caller who does not already hold the token must not be able to force the
+// legitimate session out.
+export function revokeSession(token) {
+  const session = readJsonFile(sessionPath());
+  if (!session) return false;
+  if (!token || !digestEqual(session.token, token)) return false;
+  rmSync(sessionPath(), { force: true });
+  return true;
+}
+// The local host CLI (`wiki-manager logout`) has direct access to this state
+// directory, same as `resetTotpEnrollment` below — it reads the active
+// token itself rather than calling /logout without proof of possession.
+export function currentSessionToken() {
+  const session = readJsonFile(sessionPath());
+  return session && typeof session.token === 'string' ? session.token : null;
+}
+/*
+ Re-enrollment after a lost authenticator: wipes the enrolled secret AND the
+ active session, so the next login page shows a fresh QR code. Reachable only
+ from the host CLI (`wiki-manager login --reset`): the runtime reads these
+ files fresh on every request, so the deletion takes effect immediately, and
+ no HTTP route can trigger it.
+ */
+export function resetTotpEnrollment() {
+  pendingEnrollment = null;
+  pendingEnrollmentSince = 0;
+  rmSync(totpPath(), { force: true });
+  rmSync(sessionPath(), { force: true });
+}
+// ── Attempt rate limiting (in-memory) ────────────────────────────────────────
+// 6 digits is a small space: refuse after too many tries per address.
+const ATTEMPT_LIMIT = 10;
+const ATTEMPT_WINDOW_MS = 10 * 60 * 1000;
+const attempts = new Map();
+export function loginAttemptAllowed(address) {
+  const now = Date.now();
+  const key = String(address ?? 'unknown');
+  const record = attempts.get(key);
+  if (!record || now >= record.resetAt) {
+    attempts.set(key, { count: 1, resetAt: now + ATTEMPT_WINDOW_MS });
+    return { ok: true, remaining: ATTEMPT_LIMIT - 1 };
+  }
+  if (record.count >= ATTEMPT_LIMIT) {
+    const retryAfterSeconds = Math.max(1, Math.ceil((record.resetAt - now) / 1000));
+    return { ok: false, retryAfterSeconds };
+  }
+  record.count += 1;
+  return { ok: true, remaining: ATTEMPT_LIMIT - record.count };
+}
+export function resetLoginAttempts(address) {
+  attempts.delete(String(address ?? 'unknown'));
+}
+// Housekeeping: drop records whose window has passed (keeps the map bounded).
+export function pruneLoginAttempts() {
+  const now = Date.now();
+  for (const [key, record] of attempts) {
+    if (now >= record.resetAt) attempts.delete(key);
+  }
+}
+export function sessionExists() {
+  return existsSync(sessionPath());
+}

package/src/runtime/loginSession.test.js ADDED Viewed

@@ -0,0 +1,143 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { totpCode } from './totp.js';
+import {
+  enrollment,
+  isTotpEnabled,
+  issueSessionWithTotp,
+  loginAttemptAllowed,
+  loginStatus,
+  resetTotpEnrollment,
+  revokeSession,
+  SESSION_TTL_MS,
+  verifySessionToken,
+} from './loginSession.js';
+// Each test gets a fresh in-memory enrollment and a fresh state dir.
+function freshStateDir() {
+  const dir = mkdtempSync(join(tmpdir(), 'login-session-'));
+  process.env.WIKI_MANAGER_STATE_DIR = dir;
+  return dir;
+}
+test.afterEach(() => {
+  const dir = process.env.WIKI_MANAGER_STATE_DIR;
+  if (dir && dir.startsWith(tmpdir())) rmSync(dir, { recursive: true, force: true });
+  delete process.env.WIKI_MANAGER_STATE_DIR;
+});
+test('enrollment publishes a secret and URI, then the first code persists it', () => {
+  freshStateDir();
+  const before = enrollment();
+  assert.ok(before.secret.match(/^[A-Z2-7]{32}$/));
+  assert.ok(before.uri.startsWith('otpauth://totp/'));
+  assert.equal(loginStatus().enrolled, false);
+  // The SAME pending secret is shown again (the page reloads, not re-rolls).
+  assert.equal(enrollment().secret, before.secret);
+  const result = issueSessionWithTotp(totpCode(before.secret));
+  assert.equal(result.ok, true);
+  assert.equal(result.enrolled, true);
+  assert.ok(result.token.length >= 32);
+  assert.equal(loginStatus().enrolled, true);
+  assert.equal(enrollment(), null);
+});
+test('a wrong code never enrolls and never issues a session', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const wrong = totpCode(pending.secret) === '000000' ? '111111' : '000000';
+  const result = issueSessionWithTotp(wrong);
+  assert.equal(result.ok, false);
+  assert.equal(result.error, 'invalid_code');
+  assert.equal(loginStatus().enrolled, false);
+});
+test('enrollment is refused from a non-loopback address', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const result = issueSessionWithTotp(totpCode(pending.secret), { remoteAddress: '192.168.1.10' });
+  assert.equal(result.ok, false);
+  assert.equal(result.error, 'enrollment_requires_loopback');
+  // From loopback the same code succeeds.
+  const ok = issueSessionWithTotp(totpCode(pending.secret), { remoteAddress: '127.0.0.1' });
+  assert.equal(ok.ok, true);
+});
+test('a verified session slides instead of expiring', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const issued = issueSessionWithTotp(totpCode(pending.secret));
+  assert.ok(issued.token);
+  // Right after issue: valid.
+  assert.equal(verifySessionToken(issued.token).ok, true);
+  // Near the end of the TTL: still valid, and the slide pushes expiry forward.
+  const late = issued.expiresAt - 1;
+  const check = verifySessionToken(issued.token, { timestamp: late });
+  assert.equal(check.ok, true);
+  assert.ok(check.expiresAt > issued.expiresAt);
+  // Past the NEW expiry the token is refused.
+  const past = check.expiresAt + 1;
+  assert.equal(verifySessionToken(issued.token, { timestamp: past, renew: false }).ok, false);
+});
+test('an unknown token is refused and revocation invalidates the real one', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const issued = issueSessionWithTotp(totpCode(pending.secret));
+  assert.equal(verifySessionToken('nope').ok, false);
+  assert.equal(revokeSession(issued.token), true);
+  assert.equal(verifySessionToken(issued.token).ok, false);
+  assert.equal(loginStatus().sessionActive, false);
+  // Revoking twice is a no-op, not an error.
+  assert.equal(revokeSession(issued.token), false);
+});
+test('resetTotpEnrollment wipes the secret and the session for re-enrollment', () => {
+  freshStateDir();
+  const pending = enrollment();
+  const issued = issueSessionWithTotp(totpCode(pending.secret));
+  assert.equal(loginStatus().enrolled, true);
+  assert.equal(loginStatus().sessionActive, true);
+  resetTotpEnrollment();
+  const status = loginStatus();
+  assert.equal(status.enrolled, false);
+  assert.equal(status.sessionActive, false);
+  assert.equal(verifySessionToken(issued.token).ok, false);
+  // A fresh enrollment secret is generated for the next page.
+  const fresh = enrollment();
+  assert.ok(fresh.secret);
+  assert.notEqual(fresh.secret, pending.secret);
+});
+test('login attempts are rate-limited per address', () => {
+  for (let index = 0; index < 10; index++) {
+    const allowed = loginAttemptAllowed('127.0.0.1');
+    assert.equal(allowed.ok, true, `attempt ${index}`);
+  }
+  const refused = loginAttemptAllowed('127.0.0.1');
+  assert.equal(refused.ok, false);
+  assert.ok(refused.retryAfterSeconds > 0);
+  // Another address is unaffected.
+  assert.equal(loginAttemptAllowed('10.0.0.2').ok, true);
+});
+test('TOTP can be disabled from the environment', () => {
+  freshStateDir();
+  process.env.WIKI_MANAGER_TOTP = 'off';
+  assert.equal(isTotpEnabled(), false);
+  assert.equal(enrollment(), null);
+  delete process.env.WIKI_MANAGER_TOTP;
+});
+test('the default session TTL is 12 hours', () => {
+  assert.equal(SESSION_TTL_MS, 12 * 60 * 60 * 1000);
+});

package/src/runtime/qrCode.js ADDED Viewed

@@ -0,0 +1,15 @@
+import qrcodeGenerator from './vendor/qrcode.cjs';
+/*
+ Thin wrapper over the vendored MIT qrcode-generator (Kazuhiko Arase, 2009 —
+ see vendor/qrcode.cjs header). The login page renders the enrollment QR as a
+ responsive SVG; the otpauth:// URI is ASCII-only, so the generator's default
+ latin-1 byte conversion is sufficient.
+ */
+export function qrSvg(content, { cellSize = 4, margin = 8 } = {}) {
+  const qr = qrcodeGenerator(0, 'M');
+  qr.addData(String(content), 'Byte');
+  qr.make();
+  return qr.createSvgTag({ cellSize, margin, scalable: true, alt: { text: 'QR code' } });
+}

package/src/runtime/runner.js CHANGED Viewed

@@ -63,7 +63,12 @@ export function conversationSeed(session, currentInput, { limit = 12, maxChars =
   const conversation = Array.isArray(session.agentProjection?.conversation)
     ? session.agentProjection.conversation
     : [];
+  // Everything before the last compact (conversation_reset) is forgotten for
+  // grounding, while it stays visible in the displayed thread. The boundary is
+  // an index into the same array, so no message is actually removed.
+  const seedStart = Math.max(0, Number(session.agentProjection?.conversationSeedStart) || 0);
   const seed = conversation
+    .slice(seedStart)
     .filter((message) => ['user', 'assistant'].includes(message?.role) && String(message?.content ?? '').trim())
     .slice(-limit)
     .map((message) => ({ role: message.role, content: String(message.content).slice(0, maxChars) }));
@@ -71,6 +76,13 @@ export function conversationSeed(session, currentInput, { limit = 12, maxChars =
   // drop it from the seed to avoid sending it twice.
   const last = seed.at(-1);
   if (last && last.role === 'user' && last.content === String(currentInput ?? '').slice(0, maxChars)) seed.pop();
+  // A compact does not just cut the older turns — it replaces them with a
+  // short summary (see /conversation/compact), so what was agreed there is
+  // not lost to the grounding window entirely, only condensed.
+  const summary = String(session.agentProjection?.conversationSummary ?? '').trim();
+  if (summary) {
+    seed.unshift({ role: 'user', content: `[Summary of earlier conversation, compacted]\n${summary.slice(0, maxChars)}` });
+  }
   return seed;
 }